HSM Credential Storage for Application-Specific Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing credentials in industrial environments, such as plant control systems, face challenges in ensuring secure access and preventing unauthorized duplication, especially when integrating new components without altering source code, particularly when using hardware security modules like TPMs.
Innovation Solution
A method involving generating application-specific credentials using a hardware security module (HSM), encrypting them, and storing them on the HSM, ensuring only the generating software application can access, while preventing duplication by using transient credentials and hierarchical access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are stored in plain format on the device, then software applications can easily access them, but unauthorized access and duplication of credentials becomes possible
Solution Approach 1:
The patent extracts the credential storage function from the general file system and places it within the Hardware Security Module (HSM). The HSM maintains an internal credential store that is inaccessible from outside, separating the credential management function from the rest of the system while allowing controlled access through the HSM's interface
Solution Approach 2:
The HSM acts as an intermediary between software applications and credentials. Instead of applications directly accessing credential files, they must go through the HSM which verifies authorization, manages access policies, and provides credentials through controlled interfaces, thus preventing unauthorized access while maintaining ease of legitimate access
2Reliability
If credentials are fully encrypted on the drive, then protection is provided when drive is removed, but access is restricted even when drive is present
Solution Approach 1:
The patent implements different security characteristics for different locations. Credentials stored in the HSM's internal store have high security (protected even when device is compromised), while the HSM interface provides controlled access for authorized applications. The security level varies by location and access method, optimizing both protection and accessibility
3Adaptability or versatility
If new components are integrated into the system, then system functionality is enhanced, but credential management complexity increases
Solution Approach 1:
The HSM provides universal credential management services to all software applications and components in the system. Instead of each component needing its own credential storage and protection mechanism, the HSM serves as a universal credential manager that handles authentication, authorization, and credential distribution for diverse components through standardized interfaces
Data Source
Figure 1
AI summary
The invention relates to a method, in particular a computer-aided method, for regulating access to a data object, wherein the data object is located on a device and the device has a Hardware Security Module (HSM) or is connected to such a device, wherein the method comprises the following steps: generating an application-related credential, which is assigned to the data object, by a software application contained on the device, in particular using the Hardware Security Module (HSM);Encrypting the application-related credential by the Hardware Security Module (HSM) and storing the encrypted application-related credential, particularly in the context of the software application, so that only the software application that generated the application-related credential can access the data object using a key via the application-related credential stored on the Hardware Security Module (HSM) and/or loaded into the Hardware Security Module (HSM);